SSL certificate doesn't match | DSE Troubleshooting guide
This message shows that 10.236.136.55 is being resolved to node35.foo.com, then node node35.foo.com is being asked for it's certificate which is a generic certificate issued with a CN of clustercert.foo.com. For security reasons, SSL verifies that node35.foo.com and clustercert.foo.com match. If they don't match, a certificate mismatch error occurs. Do not use a generic certificate across multiple nodes, because each node has a different name that won't match. Do not copy a certificate that is issued to node35.foo.com over to another node.
Nodes must be configured with correct names that match the certificate CN. You can use a wildcard in named certificates, like * in CN=*.foo.com, or any other matching mechanism allowed by SSL standards. All others configurations where names mismatch will result in an error.
Read full article from SSL certificate doesn't match | DSE Troubleshooting guide
No comments:
Post a Comment